It's worth noting that mitigations=off doesn't even restore all the performance, compared to kernel versions before Spectre mitigations were added at all. miti

It's worth noting that mitigations=off doesn't even restore all the performance, compared to kernel versions before Spectre mitigations were added at all. mitigations=off can only "patch out" some expensive instructions in the syscall path, or sometimes take a different path entirely, but it can't go back to the simple code before this was added in the first place. It also can't undo effects of compiler flags like -mindirect-branch which change the compiled code. I haven't tested it recently, but when I looked at this more than a year ago, the numbers for a simple syscall (which doesn't do much work beyond the syscall mechanics itself) were something like 130ns, 250ns, 700ns for a "pre mitigation kernel", "new kernel with mitigations=off" and "new kernel with mitigations=on". Some of the numbers have improved since then as better mitigations have been found, and/or improved CPU support for mitigations via microcode updates.